From b6734fbbbcef795654b243a8cbcc5c39b4547fd1 Mon Sep 17 00:00:00 2001 From: Robert Godfrey Date: Sun, 6 Jul 2014 21:28:20 +0000 Subject: QPID-5878 : [Java Broker] Add SCRAM-SHA-256 SASL support git-svn-id: https://svn.apache.org/repos/asf/qpid/trunk@1608295 13f79535-47bb-0310-9956-ffa450edef68 --- .../manager/AbstractAuthenticationManager.java | 3 - .../AbstractScramAuthenticationManager.java | 397 +++++++++++++++++++++ .../security/auth/manager/ScramAuthUser.java | 4 +- .../manager/ScramSHA1AuthenticationManager.java | 349 +----------------- .../manager/ScramSHA256AuthenticationManager.java | 66 ++++ .../auth/sasl/scram/ScramSHA1SaslServer.java | 273 -------------- .../security/auth/sasl/scram/ScramSaslServer.java | 282 +++++++++++++++ 7 files changed, 758 insertions(+), 616 deletions(-) create mode 100644 qpid/java/broker-core/src/main/java/org/apache/qpid/server/security/auth/manager/AbstractScramAuthenticationManager.java create mode 100644 qpid/java/broker-core/src/main/java/org/apache/qpid/server/security/auth/manager/ScramSHA256AuthenticationManager.java delete mode 100644 qpid/java/broker-core/src/main/java/org/apache/qpid/server/security/auth/sasl/scram/ScramSHA1SaslServer.java create mode 100644 qpid/java/broker-core/src/main/java/org/apache/qpid/server/security/auth/sasl/scram/ScramSaslServer.java (limited to 'qpid/java/broker-core') diff --git a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/security/auth/manager/AbstractAuthenticationManager.java b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/security/auth/manager/AbstractAuthenticationManager.java index 597b9e3bb1..a2bb5cb91a 100644 --- a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/security/auth/manager/AbstractAuthenticationManager.java +++ b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/security/auth/manager/AbstractAuthenticationManager.java @@ -26,7 +26,6 @@ import java.util.Collection; import java.util.HashMap; import java.util.Map; import java.util.Set; -import java.util.UUID; import java.util.concurrent.atomic.AtomicReference; import org.apache.log4j.Logger; @@ -148,8 +147,6 @@ public abstract class AbstractAuthenticationManager(attributes); - attributes.put(ConfiguredObject.ID, UUID.randomUUID()); - attributes.put(ConfiguredObject.DESIRED_STATE, State.ACTIVE); PreferencesProvider pp = getObjectFactory().create(PreferencesProvider.class, attributes, this); _preferencesProvider = pp; diff --git a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/security/auth/manager/AbstractScramAuthenticationManager.java b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/security/auth/manager/AbstractScramAuthenticationManager.java new file mode 100644 index 0000000000..f08c37008a --- /dev/null +++ b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/security/auth/manager/AbstractScramAuthenticationManager.java @@ -0,0 +1,397 @@ +/* + * + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + * + */ +package org.apache.qpid.server.security.auth.manager; + +import java.io.IOException; +import java.nio.charset.Charset; +import java.security.InvalidKeyException; +import java.security.NoSuchAlgorithmException; +import java.security.Principal; +import java.security.SecureRandom; +import java.util.Arrays; +import java.util.Collections; +import java.util.HashMap; +import java.util.Map; +import java.util.UUID; +import java.util.concurrent.ConcurrentHashMap; + +import javax.crypto.Mac; +import javax.crypto.spec.SecretKeySpec; +import javax.security.auth.login.AccountNotFoundException; +import javax.security.sasl.SaslException; +import javax.security.sasl.SaslServer; +import javax.xml.bind.DatatypeConverter; + +import org.apache.qpid.server.configuration.updater.Task; +import org.apache.qpid.server.configuration.updater.VoidTaskWithException; +import org.apache.qpid.server.model.Broker; +import org.apache.qpid.server.model.ConfiguredObject; +import org.apache.qpid.server.model.PasswordCredentialManagingAuthenticationProvider; +import org.apache.qpid.server.model.State; +import org.apache.qpid.server.model.User; +import org.apache.qpid.server.security.access.Operation; +import org.apache.qpid.server.security.auth.AuthenticationResult; +import org.apache.qpid.server.security.auth.UsernamePrincipal; +import org.apache.qpid.server.security.auth.sasl.scram.ScramSaslServer; + +public abstract class AbstractScramAuthenticationManager> + extends AbstractAuthenticationManager + implements PasswordCredentialManagingAuthenticationProvider +{ + public static final String SCRAM_USER_TYPE = "scram"; + + static final Charset ASCII = Charset.forName("ASCII"); + private final SecureRandom _random = new SecureRandom(); + + private int _iterationCount = 4096; + + private Map _users = new ConcurrentHashMap(); + + + protected AbstractScramAuthenticationManager(final Map attributes, final Broker broker) + { + super(attributes, broker); + } + + @Override + public void initialise() + { + + } + + @Override + public String getMechanisms() + { + return getMechanismName(); + } + + protected abstract String getMechanismName(); + + @Override + public SaslServer createSaslServer(final String mechanism, + final String localFQDN, + final Principal externalPrincipal) + throws SaslException + { + return new ScramSaslServer(this, getMechanismName(), getHmacName(), getDigestName()); + } + + protected abstract String getDigestName(); + + @Override + public AuthenticationResult authenticate(final SaslServer server, final byte[] response) + { + try + { + // Process response from the client + byte[] challenge = server.evaluateResponse(response != null ? response : new byte[0]); + + if (server.isComplete()) + { + final String userId = server.getAuthorizationID(); + return new AuthenticationResult(new UsernamePrincipal(userId)); + } + else + { + return new AuthenticationResult(challenge, AuthenticationResult.AuthenticationStatus.CONTINUE); + } + } + catch (SaslException e) + { + return new AuthenticationResult(AuthenticationResult.AuthenticationStatus.ERROR, e); + } + } + + @Override + public AuthenticationResult authenticate(final String username, final String password) + { + ScramAuthUser user = getUser(username); + if(user != null) + { + final String[] usernamePassword = user.getPassword().split(","); + byte[] salt = DatatypeConverter.parseBase64Binary(usernamePassword[0]); + try + { + if(Arrays.equals(DatatypeConverter.parseBase64Binary(usernamePassword[1]), + createSaltedPassword(salt, password))) + { + return new AuthenticationResult(new UsernamePrincipal(username)); + } + } + catch (SaslException e) + { + return new AuthenticationResult(AuthenticationResult.AuthenticationStatus.ERROR,e); + } + + } + + return new AuthenticationResult(AuthenticationResult.AuthenticationStatus.ERROR); + + + } + + + public int getIterationCount() + { + return _iterationCount; + } + + public byte[] getSalt(final String username) + { + ScramAuthUser user = getUser(username); + + if(user == null) + { + // don't disclose that the user doesn't exist, just generate random data so the failure is indistinguishable + // from the "wrong password" case + + byte[] salt = new byte[32]; + _random.nextBytes(salt); + return salt; + } + else + { + return DatatypeConverter.parseBase64Binary(user.getPassword().split(",")[0]); + } + } + + private static final byte[] INT_1 = new byte[]{0, 0, 0, 1}; + + public byte[] getSaltedPassword(final String username) throws SaslException + { + ScramAuthUser user = getUser(username); + if(user == null) + { + throw new SaslException("Authentication Failed"); + } + else + { + return DatatypeConverter.parseBase64Binary(user.getPassword().split(",")[1]); + } + } + + private ScramAuthUser getUser(final String username) + { + return _users.get(username); + } + + private byte[] createSaltedPassword(byte[] salt, String password) throws SaslException + { + Mac mac = createSha1Hmac(password.getBytes(ASCII)); + + mac.update(salt); + mac.update(INT_1); + byte[] result = mac.doFinal(); + + byte[] previous = null; + for(int i = 1; i < getIterationCount(); i++) + { + mac.update(previous != null? previous: result); + previous = mac.doFinal(); + for(int x = 0; x < result.length; x++) + { + result[x] ^= previous[x]; + } + } + + return result; + + } + + private Mac createSha1Hmac(final byte[] keyBytes) + throws SaslException + { + try + { + SecretKeySpec key = new SecretKeySpec(keyBytes, getHmacName()); + Mac mac = Mac.getInstance(getHmacName()); + mac.init(key); + return mac; + } + catch (NoSuchAlgorithmException e) + { + throw new SaslException(e.getMessage(), e); + } + catch (InvalidKeyException e) + { + throw new SaslException(e.getMessage(), e); + } + } + + protected abstract String getHmacName(); + + @Override + public boolean createUser(final String username, final String password, final Map attributes) + { + return runTask(new Task() + { + @Override + public Boolean execute() + { + getSecurityManager().authoriseUserOperation(Operation.CREATE, username); + if (_users.containsKey(username)) + { + throw new IllegalArgumentException("User '" + username + "' already exists"); + } + try + { + Map userAttrs = new HashMap(); + userAttrs.put(User.ID, UUID.randomUUID()); + userAttrs.put(User.NAME, username); + userAttrs.put(User.PASSWORD, createStoredPassword(password)); + userAttrs.put(User.TYPE, SCRAM_USER_TYPE); + ScramAuthUser user = new ScramAuthUser(userAttrs, AbstractScramAuthenticationManager.this); + user.create(); + + return true; + } + catch (SaslException e) + { + throw new IllegalArgumentException(e); + } + } + }); + } + + org.apache.qpid.server.security.SecurityManager getSecurityManager() + { + return getBroker().getSecurityManager(); + } + + @Override + public void deleteUser(final String user) throws AccountNotFoundException + { + runTask(new VoidTaskWithException() + { + @Override + public void execute() throws AccountNotFoundException + { + final ScramAuthUser authUser = getUser(user); + if(authUser != null) + { + authUser.setState(State.DELETED); + } + else + { + throw new AccountNotFoundException("No such user: '" + user + "'"); + } + } + }); + } + + @Override + public void setPassword(final String username, final String password) throws AccountNotFoundException + { + runTask(new VoidTaskWithException() + { + @Override + public void execute() throws AccountNotFoundException + { + + final ScramAuthUser authUser = getUser(username); + if (authUser != null) + { + authUser.setPassword(password); + } + else + { + throw new AccountNotFoundException("No such user: '" + username + "'"); + } + } + }); + + } + + @Override + public Map> getUsers() + { + return runTask(new Task>>() + { + @Override + public Map> execute() + { + + Map> users = new HashMap>(); + for (String user : _users.keySet()) + { + users.put(user, Collections.emptyMap()); + } + return users; + } + }); + } + + @Override + public void reload() throws IOException + { + + } + + @Override + public void recoverUser(final User user) + { + _users.put(user.getName(), (ScramAuthUser) user); + } + + protected String createStoredPassword(final String password) throws SaslException + { + byte[] salt = new byte[32]; + _random.nextBytes(salt); + byte[] passwordBytes = createSaltedPassword(salt, password); + return DatatypeConverter.printBase64Binary(salt) + "," + DatatypeConverter.printBase64Binary(passwordBytes); + } + + @Override + public C addChild(final Class childClass, + final Map attributes, + final ConfiguredObject... otherParents) + { + if(childClass == User.class) + { + String username = (String) attributes.get("name"); + String password = (String) attributes.get("password"); + + if(createUser(username, password,null)) + { + @SuppressWarnings("unchecked") + C user = (C) _users.get(username); + return user; + } + else + { + return null; + + } + } + return super.addChild(childClass, attributes, otherParents); + } + + void doDeleted() + { + deleted(); + } + + Map getUserMap() + { + return _users; + } + +} diff --git a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/security/auth/manager/ScramAuthUser.java b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/security/auth/manager/ScramAuthUser.java index 15cd1d82a6..9a2d27f512 100644 --- a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/security/auth/manager/ScramAuthUser.java +++ b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/security/auth/manager/ScramAuthUser.java @@ -44,12 +44,12 @@ import org.apache.qpid.server.security.access.Operation; class ScramAuthUser extends AbstractConfiguredObject implements User { - private ScramSHA1AuthenticationManager _authenticationManager; + private AbstractScramAuthenticationManager _authenticationManager; @ManagedAttributeField private String _password; @ManagedObjectFactoryConstructor - ScramAuthUser(final Map attributes, ScramSHA1AuthenticationManager parent) + ScramAuthUser(final Map attributes, AbstractScramAuthenticationManager parent) { super(parentsMap(parent), attributes); _authenticationManager = parent; diff --git a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/security/auth/manager/ScramSHA1AuthenticationManager.java b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/security/auth/manager/ScramSHA1AuthenticationManager.java index 2138f4899e..6a48d29a71 100644 --- a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/security/auth/manager/ScramSHA1AuthenticationManager.java +++ b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/security/auth/manager/ScramSHA1AuthenticationManager.java @@ -20,53 +20,23 @@ */ package org.apache.qpid.server.security.auth.manager; -import java.io.IOException; import java.nio.charset.Charset; -import java.security.InvalidKeyException; -import java.security.NoSuchAlgorithmException; -import java.security.Principal; -import java.security.SecureRandom; -import java.util.Arrays; -import java.util.Collections; -import java.util.HashMap; import java.util.Map; -import java.util.UUID; -import java.util.concurrent.ConcurrentHashMap; -import javax.crypto.Mac; -import javax.crypto.spec.SecretKeySpec; -import javax.security.auth.login.AccountNotFoundException; -import javax.security.sasl.SaslException; -import javax.security.sasl.SaslServer; -import javax.xml.bind.DatatypeConverter; - -import org.apache.qpid.server.configuration.updater.Task; -import org.apache.qpid.server.configuration.updater.VoidTaskWithException; import org.apache.qpid.server.model.Broker; -import org.apache.qpid.server.model.ConfiguredObject; import org.apache.qpid.server.model.ManagedObject; import org.apache.qpid.server.model.ManagedObjectFactoryConstructor; -import org.apache.qpid.server.model.PasswordCredentialManagingAuthenticationProvider; -import org.apache.qpid.server.model.State; -import org.apache.qpid.server.model.User; -import org.apache.qpid.server.security.SecurityManager; -import org.apache.qpid.server.security.access.Operation; -import org.apache.qpid.server.security.auth.AuthenticationResult; -import org.apache.qpid.server.security.auth.UsernamePrincipal; -import org.apache.qpid.server.security.auth.sasl.scram.ScramSHA1SaslServer; @ManagedObject( category = false, type = "SCRAM-SHA-1" ) public class ScramSHA1AuthenticationManager - extends AbstractAuthenticationManager - implements PasswordCredentialManagingAuthenticationProvider + extends AbstractScramAuthenticationManager { - public static final String SCRAM_USER_TYPE = "scram"; public static final String PROVIDER_TYPE = "SCRAM-SHA-1"; + private static final String HMAC_NAME = "HmacSHA1"; + static final Charset ASCII = Charset.forName("ASCII"); - public static final String HMAC_SHA_1 = "HmacSHA1"; - private final SecureRandom _random = new SecureRandom(); - private int _iterationCount = 4096; - private Map _users = new ConcurrentHashMap(); + private static final String MECHANISM = "SCRAM-SHA-1"; + private static final String DIGEST_NAME = "SHA-1"; @ManagedObjectFactoryConstructor @@ -76,318 +46,21 @@ public class ScramSHA1AuthenticationManager } @Override - public void initialise() - { - - } - - @Override - public String getMechanisms() - { - return ScramSHA1SaslServer.MECHANISM; - } - - @Override - public SaslServer createSaslServer(final String mechanism, - final String localFQDN, - final Principal externalPrincipal) - throws SaslException - { - return new ScramSHA1SaslServer(this); - } - - @Override - public AuthenticationResult authenticate(final SaslServer server, final byte[] response) - { - try - { - // Process response from the client - byte[] challenge = server.evaluateResponse(response != null ? response : new byte[0]); - - if (server.isComplete()) - { - final String userId = server.getAuthorizationID(); - return new AuthenticationResult(new UsernamePrincipal(userId)); - } - else - { - return new AuthenticationResult(challenge, AuthenticationResult.AuthenticationStatus.CONTINUE); - } - } - catch (SaslException e) - { - return new AuthenticationResult(AuthenticationResult.AuthenticationStatus.ERROR, e); - } - } - - @Override - public AuthenticationResult authenticate(final String username, final String password) - { - ScramAuthUser user = getUser(username); - if(user != null) - { - final String[] usernamePassword = user.getPassword().split(","); - byte[] salt = DatatypeConverter.parseBase64Binary(usernamePassword[0]); - try - { - if(Arrays.equals(DatatypeConverter.parseBase64Binary(usernamePassword[1]),createSaltedPassword(salt, password))) - { - return new AuthenticationResult(new UsernamePrincipal(username)); - } - } - catch (SaslException e) - { - return new AuthenticationResult(AuthenticationResult.AuthenticationStatus.ERROR,e); - } - - } - - return new AuthenticationResult(AuthenticationResult.AuthenticationStatus.ERROR); - - - } - - - public int getIterationCount() - { - return _iterationCount; - } - - public byte[] getSalt(final String username) - { - ScramAuthUser user = getUser(username); - - if(user == null) - { - // don't disclose that the user doesn't exist, just generate random data so the failure is indistinguishable - // from the "wrong password" case - - byte[] salt = new byte[32]; - _random.nextBytes(salt); - return salt; - } - else - { - return DatatypeConverter.parseBase64Binary(user.getPassword().split(",")[0]); - } - } - - private static final byte[] INT_1 = new byte[]{0, 0, 0, 1}; - - public byte[] getSaltedPassword(final String username) throws SaslException - { - ScramAuthUser user = getUser(username); - if(user == null) - { - throw new SaslException("Authentication Failed"); - } - else - { - return DatatypeConverter.parseBase64Binary(user.getPassword().split(",")[1]); - } - } - - private ScramAuthUser getUser(final String username) - { - return _users.get(username); - } - - private byte[] createSaltedPassword(byte[] salt, String password) throws SaslException - { - Mac mac = createSha1Hmac(password.getBytes(ASCII)); - - mac.update(salt); - mac.update(INT_1); - byte[] result = mac.doFinal(); - - byte[] previous = null; - for(int i = 1; i < getIterationCount(); i++) - { - mac.update(previous != null? previous: result); - previous = mac.doFinal(); - for(int x = 0; x < result.length; x++) - { - result[x] ^= previous[x]; - } - } - - return result; - - } - - private Mac createSha1Hmac(final byte[] keyBytes) - throws SaslException - { - try - { - SecretKeySpec key = new SecretKeySpec(keyBytes, HMAC_SHA_1); - Mac mac = Mac.getInstance(HMAC_SHA_1); - mac.init(key); - return mac; - } - catch (NoSuchAlgorithmException e) - { - throw new SaslException(e.getMessage(), e); - } - catch (InvalidKeyException e) - { - throw new SaslException(e.getMessage(), e); - } - } - - @Override - public boolean createUser(final String username, final String password, final Map attributes) - { - return runTask(new Task() - { - @Override - public Boolean execute() - { - getSecurityManager().authoriseUserOperation(Operation.CREATE, username); - if (_users.containsKey(username)) - { - throw new IllegalArgumentException("User '" + username + "' already exists"); - } - try - { - Map userAttrs = new HashMap(); - userAttrs.put(User.ID, UUID.randomUUID()); - userAttrs.put(User.NAME, username); - userAttrs.put(User.PASSWORD, createStoredPassword(password)); - userAttrs.put(User.TYPE, SCRAM_USER_TYPE); - ScramAuthUser user = new ScramAuthUser(userAttrs, ScramSHA1AuthenticationManager.this); - user.create(); - - return true; - } - catch (SaslException e) - { - throw new IllegalArgumentException(e); - } - } - }); - } - - SecurityManager getSecurityManager() - { - return getBroker().getSecurityManager(); - } - - @Override - public void deleteUser(final String user) throws AccountNotFoundException - { - runTask(new VoidTaskWithException() - { - @Override - public void execute() throws AccountNotFoundException - { - final ScramAuthUser authUser = getUser(user); - if(authUser != null) - { - authUser.setState(State.DELETED); - } - else - { - throw new AccountNotFoundException("No such user: '" + user + "'"); - } - } - }); - } - - @Override - public void setPassword(final String username, final String password) throws AccountNotFoundException + protected String getMechanismName() { - runTask(new VoidTaskWithException() - { - @Override - public void execute() throws AccountNotFoundException - { - - final ScramAuthUser authUser = getUser(username); - if (authUser != null) - { - authUser.setPassword(password); - } - else - { - throw new AccountNotFoundException("No such user: '" + username + "'"); - } - } - }); - - } - - @Override - public Map> getUsers() - { - return runTask(new Task>>() - { - @Override - public Map> execute() - { - - Map> users = new HashMap>(); - for (String user : _users.keySet()) - { - users.put(user, Collections.emptyMap()); - } - return users; - } - }); - } - - @Override - public void reload() throws IOException - { - + return MECHANISM; } @Override - public void recoverUser(final User user) - { - _users.put(user.getName(), (ScramAuthUser) user); - } - - protected String createStoredPassword(final String password) throws SaslException + protected String getDigestName() { - byte[] salt = new byte[32]; - _random.nextBytes(salt); - byte[] passwordBytes = createSaltedPassword(salt, password); - return DatatypeConverter.printBase64Binary(salt) + "," + DatatypeConverter.printBase64Binary(passwordBytes); + return DIGEST_NAME; } @Override - public C addChild(final Class childClass, - final Map attributes, - final ConfiguredObject... otherParents) + protected String getHmacName() { - if(childClass == User.class) - { - String username = (String) attributes.get("name"); - String password = (String) attributes.get("password"); - - if(createUser(username, password,null)) - { - @SuppressWarnings("unchecked") - C user = (C) _users.get(username); - return user; - } - else - { - return null; - - } - } - return super.addChild(childClass, attributes, otherParents); + return HMAC_NAME; } - void doDeleted() - { - deleted(); - } - - Map getUserMap() - { - return _users; - } } diff --git a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/security/auth/manager/ScramSHA256AuthenticationManager.java b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/security/auth/manager/ScramSHA256AuthenticationManager.java new file mode 100644 index 0000000000..ea5b82fdd5 --- /dev/null +++ b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/security/auth/manager/ScramSHA256AuthenticationManager.java @@ -0,0 +1,66 @@ +/* + * + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + * + */ +package org.apache.qpid.server.security.auth.manager; + +import java.nio.charset.Charset; +import java.util.Map; + +import org.apache.qpid.server.model.Broker; +import org.apache.qpid.server.model.ManagedObject; +import org.apache.qpid.server.model.ManagedObjectFactoryConstructor; + +@ManagedObject( category = false, type = "SCRAM-SHA-256" ) +public class ScramSHA256AuthenticationManager + extends AbstractScramAuthenticationManager +{ + public static final String PROVIDER_TYPE = "SCRAM-SHA-256"; + private static final String HMAC_NAME = "HmacSHA256"; + + static final Charset ASCII = Charset.forName("ASCII"); + private static final String MECHANISM = "SCRAM-SHA-256"; + private static final String DIGEST_NAME = "SHA-256"; + + + @ManagedObjectFactoryConstructor + protected ScramSHA256AuthenticationManager(final Map attributes, final Broker broker) + { + super(attributes, broker); + } + + @Override + protected String getMechanismName() + { + return MECHANISM; + } + + @Override + protected String getDigestName() + { + return DIGEST_NAME; + } + + @Override + protected String getHmacName() + { + return HMAC_NAME; + } + +} diff --git a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/security/auth/sasl/scram/ScramSHA1SaslServer.java b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/security/auth/sasl/scram/ScramSHA1SaslServer.java deleted file mode 100644 index 71ef386e3e..0000000000 --- a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/security/auth/sasl/scram/ScramSHA1SaslServer.java +++ /dev/null @@ -1,273 +0,0 @@ -/* - * - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - * - */ -package org.apache.qpid.server.security.auth.sasl.scram; - -import org.apache.qpid.server.security.auth.manager.ScramSHA1AuthenticationManager; - -import javax.crypto.Mac; -import javax.crypto.spec.SecretKeySpec; -import javax.security.sasl.SaslException; -import javax.security.sasl.SaslServer; -import javax.xml.bind.DatatypeConverter; -import java.io.UnsupportedEncodingException; -import java.nio.charset.Charset; -import java.security.InvalidKeyException; -import java.security.MessageDigest; -import java.security.NoSuchAlgorithmException; -import java.util.Arrays; -import java.util.UUID; - -public class ScramSHA1SaslServer implements SaslServer -{ - public static final String MECHANISM = "SCRAM-SHA-1"; - - private static final Charset ASCII = Charset.forName("ASCII"); - - private final ScramSHA1AuthenticationManager _authManager; - private State _state = State.INITIAL; - private String _nonce; - private String _username; - private byte[] _gs2Header; - private String _serverFirstMessage; - private String _clientFirstMessageBare; - private byte[] _serverSignature; - - public ScramSHA1SaslServer(final ScramSHA1AuthenticationManager authenticationManager) - { - _authManager = authenticationManager; - } - - enum State - { - INITIAL, - SERVER_FIRST_MESSAGE_SENT, - COMPLETE - } - - @Override - public String getMechanismName() - { - return MECHANISM; - } - - @Override - public byte[] evaluateResponse(final byte[] response) throws SaslException - { - byte[] challenge; - switch (_state) - { - case INITIAL: - challenge = generateServerFirstMessage(response); - _state = State.SERVER_FIRST_MESSAGE_SENT; - break; - case SERVER_FIRST_MESSAGE_SENT: - challenge = generateServerFinalMessage(response); - _state = State.COMPLETE; - break; - default: - throw new SaslException("No response expected in state " + _state); - - } - return challenge; - } - - private byte[] generateServerFirstMessage(final byte[] response) throws SaslException - { - String clientFirstMessage = new String(response, ASCII); - if(!clientFirstMessage.startsWith("n")) - { - throw new SaslException("Cannot parse gs2-header"); - } - String[] parts = clientFirstMessage.split(","); - if(parts.length < 4) - { - throw new SaslException("Cannot parse client first message"); - } - _gs2Header = ("n,"+parts[1]+",").getBytes(ASCII); - _clientFirstMessageBare = clientFirstMessage.substring(_gs2Header.length); - if(!parts[2].startsWith("n=")) - { - throw new SaslException("Cannot parse client first message"); - } - _username = decodeUsername(parts[2].substring(2)); - if(!parts[3].startsWith("r=")) - { - throw new SaslException("Cannot parse client first message"); - } - _nonce = parts[3].substring(2) + UUID.randomUUID().toString(); - - int count = _authManager.getIterationCount(); - byte[] saltBytes = _authManager.getSalt(_username); - _serverFirstMessage = "r="+_nonce+",s="+ DatatypeConverter.printBase64Binary(saltBytes)+",i=" + count; - return _serverFirstMessage.getBytes(ASCII); - } - - private String decodeUsername(String username) throws SaslException - { - if(username.contains("=")) - { - String check = username; - while (check.contains("=")) - { - check = check.substring(check.indexOf('=') + 1); - if (!(check.startsWith("2C") || check.startsWith("3D"))) - { - throw new SaslException("Invalid username"); - } - } - username = username.replace("=2C", ","); - username = username.replace("=3D","="); - } - return username; - } - - - private byte[] generateServerFinalMessage(final byte[] response) throws SaslException - { - try - { - String clientFinalMessage = new String(response, ASCII); - String[] parts = clientFinalMessage.split(","); - if(!parts[0].startsWith("c=")) - { - throw new SaslException("Cannot parse client final message"); - } - if(!Arrays.equals(_gs2Header,DatatypeConverter.parseBase64Binary(parts[0].substring(2)))) - { - throw new SaslException("Client final message channel bind data invalid"); - } - if(!parts[1].startsWith("r=")) - { - throw new SaslException("Cannot parse client final message"); - } - if(!parts[1].substring(2).equals(_nonce)) - { - throw new SaslException("Client final message has incorrect nonce value"); - } - if(!parts[parts.length-1].startsWith("p=")) - { - throw new SaslException("Client final message does not have proof"); - } - - String clientFinalMessageWithoutProof = clientFinalMessage.substring(0,clientFinalMessage.length()-(1+parts[parts.length-1].length())); - byte[] proofBytes = DatatypeConverter.parseBase64Binary(parts[parts.length-1].substring(2)); - - String authMessage = _clientFirstMessageBare + "," + _serverFirstMessage + "," + clientFinalMessageWithoutProof; - - byte[] saltedPassword = _authManager.getSaltedPassword(_username); - - byte[] clientKey = computeHmacSHA1(saltedPassword, "Client Key"); - - byte[] storedKey = MessageDigest.getInstance("SHA1").digest(clientKey); - - byte[] clientSignature = computeHmacSHA1(storedKey, authMessage); - - byte[] clientProof = clientKey.clone(); - for(int i = 0 ; i < clientProof.length; i++) - { - clientProof[i] ^= clientSignature[i]; - } - - if(!Arrays.equals(clientProof, proofBytes)) - { - throw new SaslException("Authentication failed"); - } - byte[] serverKey = computeHmacSHA1(saltedPassword, "Server Key"); - String finalResponse = "v=" + DatatypeConverter.printBase64Binary(computeHmacSHA1(serverKey, authMessage)); - - return finalResponse.getBytes(ASCII); - } - catch (NoSuchAlgorithmException e) - { - throw new SaslException(e.getMessage(), e); - } - catch (UnsupportedEncodingException e) - { - throw new SaslException(e.getMessage(), e); - } - } - - @Override - public boolean isComplete() - { - return _state == State.COMPLETE; - } - - @Override - public String getAuthorizationID() - { - return _username; - } - - @Override - public byte[] unwrap(final byte[] incoming, final int offset, final int len) throws SaslException - { - throw new IllegalStateException("No security layer supported"); - } - - @Override - public byte[] wrap(final byte[] outgoing, final int offset, final int len) throws SaslException - { - throw new IllegalStateException("No security layer supported"); - } - - @Override - public Object getNegotiatedProperty(final String propName) - { - return null; - } - - @Override - public void dispose() throws SaslException - { - - } - - private byte[] computeHmacSHA1(final byte[] key, final String string) - throws SaslException, UnsupportedEncodingException - { - Mac mac = createSha1Hmac(key); - mac.update(string.getBytes(ASCII)); - return mac.doFinal(); - } - - - private Mac createSha1Hmac(final byte[] keyBytes) - throws SaslException - { - try - { - SecretKeySpec key = new SecretKeySpec(keyBytes, "HmacSHA1"); - Mac mac = Mac.getInstance("HmacSHA1"); - mac.init(key); - return mac; - } - catch (NoSuchAlgorithmException e) - { - throw new SaslException(e.getMessage(), e); - } - catch (InvalidKeyException e) - { - throw new SaslException(e.getMessage(), e); - } - } - -} diff --git a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/security/auth/sasl/scram/ScramSaslServer.java b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/security/auth/sasl/scram/ScramSaslServer.java new file mode 100644 index 0000000000..f510ec32d8 --- /dev/null +++ b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/security/auth/sasl/scram/ScramSaslServer.java @@ -0,0 +1,282 @@ +/* + * + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + * + */ +package org.apache.qpid.server.security.auth.sasl.scram; + +import java.io.UnsupportedEncodingException; +import java.nio.charset.Charset; +import java.security.InvalidKeyException; +import java.security.MessageDigest; +import java.security.NoSuchAlgorithmException; +import java.util.Arrays; +import java.util.UUID; + +import javax.crypto.Mac; +import javax.crypto.spec.SecretKeySpec; +import javax.security.sasl.SaslException; +import javax.security.sasl.SaslServer; +import javax.xml.bind.DatatypeConverter; + +import org.apache.qpid.server.security.auth.manager.AbstractScramAuthenticationManager; + +public class ScramSaslServer implements SaslServer +{ + public final String _mechanism; + public final String _hmacName; + public final String _digestName; + + private static final Charset ASCII = Charset.forName("ASCII"); + + private final AbstractScramAuthenticationManager _authManager; + private State _state = State.INITIAL; + private String _nonce; + private String _username; + private byte[] _gs2Header; + private String _serverFirstMessage; + private String _clientFirstMessageBare; + private byte[] _serverSignature; + + public ScramSaslServer(final AbstractScramAuthenticationManager authenticationManager, + final String mechanism, + final String hmacName, + final String digestName) + { + _authManager = authenticationManager; + _mechanism = mechanism; + _hmacName = hmacName; + _digestName = digestName; + } + + enum State + { + INITIAL, + SERVER_FIRST_MESSAGE_SENT, + COMPLETE + } + + @Override + public String getMechanismName() + { + return _mechanism; + } + + @Override + public byte[] evaluateResponse(final byte[] response) throws SaslException + { + byte[] challenge; + switch (_state) + { + case INITIAL: + challenge = generateServerFirstMessage(response); + _state = State.SERVER_FIRST_MESSAGE_SENT; + break; + case SERVER_FIRST_MESSAGE_SENT: + challenge = generateServerFinalMessage(response); + _state = State.COMPLETE; + break; + default: + throw new SaslException("No response expected in state " + _state); + + } + return challenge; + } + + private byte[] generateServerFirstMessage(final byte[] response) throws SaslException + { + String clientFirstMessage = new String(response, ASCII); + if(!clientFirstMessage.startsWith("n")) + { + throw new SaslException("Cannot parse gs2-header"); + } + String[] parts = clientFirstMessage.split(","); + if(parts.length < 4) + { + throw new SaslException("Cannot parse client first message"); + } + _gs2Header = ("n,"+parts[1]+",").getBytes(ASCII); + _clientFirstMessageBare = clientFirstMessage.substring(_gs2Header.length); + if(!parts[2].startsWith("n=")) + { + throw new SaslException("Cannot parse client first message"); + } + _username = decodeUsername(parts[2].substring(2)); + if(!parts[3].startsWith("r=")) + { + throw new SaslException("Cannot parse client first message"); + } + _nonce = parts[3].substring(2) + UUID.randomUUID().toString(); + + int count = _authManager.getIterationCount(); + byte[] saltBytes = _authManager.getSalt(_username); + _serverFirstMessage = "r="+_nonce+",s="+ DatatypeConverter.printBase64Binary(saltBytes)+",i=" + count; + return _serverFirstMessage.getBytes(ASCII); + } + + private String decodeUsername(String username) throws SaslException + { + if(username.contains("=")) + { + String check = username; + while (check.contains("=")) + { + check = check.substring(check.indexOf('=') + 1); + if (!(check.startsWith("2C") || check.startsWith("3D"))) + { + throw new SaslException("Invalid username"); + } + } + username = username.replace("=2C", ","); + username = username.replace("=3D","="); + } + return username; + } + + + private byte[] generateServerFinalMessage(final byte[] response) throws SaslException + { + try + { + String clientFinalMessage = new String(response, ASCII); + String[] parts = clientFinalMessage.split(","); + if(!parts[0].startsWith("c=")) + { + throw new SaslException("Cannot parse client final message"); + } + if(!Arrays.equals(_gs2Header,DatatypeConverter.parseBase64Binary(parts[0].substring(2)))) + { + throw new SaslException("Client final message channel bind data invalid"); + } + if(!parts[1].startsWith("r=")) + { + throw new SaslException("Cannot parse client final message"); + } + if(!parts[1].substring(2).equals(_nonce)) + { + throw new SaslException("Client final message has incorrect nonce value"); + } + if(!parts[parts.length-1].startsWith("p=")) + { + throw new SaslException("Client final message does not have proof"); + } + + String clientFinalMessageWithoutProof = clientFinalMessage.substring(0,clientFinalMessage.length()-(1+parts[parts.length-1].length())); + byte[] proofBytes = DatatypeConverter.parseBase64Binary(parts[parts.length-1].substring(2)); + + String authMessage = _clientFirstMessageBare + "," + _serverFirstMessage + "," + clientFinalMessageWithoutProof; + + byte[] saltedPassword = _authManager.getSaltedPassword(_username); + + byte[] clientKey = computeHmac(saltedPassword, "Client Key"); + + byte[] storedKey = MessageDigest.getInstance(_digestName).digest(clientKey); + + byte[] clientSignature = computeHmac(storedKey, authMessage); + + byte[] clientProof = clientKey.clone(); + for(int i = 0 ; i < clientProof.length; i++) + { + clientProof[i] ^= clientSignature[i]; + } + + if(!Arrays.equals(clientProof, proofBytes)) + { + throw new SaslException("Authentication failed"); + } + byte[] serverKey = computeHmac(saltedPassword, "Server Key"); + String finalResponse = "v=" + DatatypeConverter.printBase64Binary(computeHmac(serverKey, authMessage)); + + return finalResponse.getBytes(ASCII); + } + catch (NoSuchAlgorithmException e) + { + throw new SaslException(e.getMessage(), e); + } + catch (UnsupportedEncodingException e) + { + throw new SaslException(e.getMessage(), e); + } + } + + @Override + public boolean isComplete() + { + return _state == State.COMPLETE; + } + + @Override + public String getAuthorizationID() + { + return _username; + } + + @Override + public byte[] unwrap(final byte[] incoming, final int offset, final int len) throws SaslException + { + throw new IllegalStateException("No security layer supported"); + } + + @Override + public byte[] wrap(final byte[] outgoing, final int offset, final int len) throws SaslException + { + throw new IllegalStateException("No security layer supported"); + } + + @Override + public Object getNegotiatedProperty(final String propName) + { + return null; + } + + @Override + public void dispose() throws SaslException + { + + } + + private byte[] computeHmac(final byte[] key, final String string) + throws SaslException, UnsupportedEncodingException + { + Mac mac = createSha1Hmac(key); + mac.update(string.getBytes(ASCII)); + return mac.doFinal(); + } + + + private Mac createSha1Hmac(final byte[] keyBytes) + throws SaslException + { + try + { + SecretKeySpec key = new SecretKeySpec(keyBytes, _hmacName); + Mac mac = Mac.getInstance(_hmacName); + mac.init(key); + return mac; + } + catch (NoSuchAlgorithmException e) + { + throw new SaslException(e.getMessage(), e); + } + catch (InvalidKeyException e) + { + throw new SaslException(e.getMessage(), e); + } + } + +} -- cgit v1.2.1